Privilege reference

Privilege reference

This is for:

System Administrator

In this article

Analytics service
Commerce service
Content service
Customer service
Knowledge service
Machine learning service
Organization service
Search service
Built-in group comparison tables

In the Coveo privilege system, each domain can be associated to one or more access level to form a privilege, which allows an API key or a group of users to perform certain operations in the Coveo Administration Console. See Manage privileges and Navigate the "Privileges" tab for more information.

However, although many domains offer a View and an Edit access level, the abilities represented by these access levels may differ from domain to domain. Some domains also offer different access level options such as Allowed or Push. So, to help you grant the appropriate privilege to groups of users or API keys, this page details what your grantee can do when granted each access level option for each domain. In the Coveo Administration Console, domains of privilege are grouped by service, and this page uses the same arrangement. Use the In this article menu on the right side of the page to browse the services and domains.

The operation of granting privileges isn’t to be taken lightly, as insufficient privileges can hinder task accomplishment, while inadequate or unnecessary privileges could lead to accidents or misuse. When allowed to delegate powers, you should have a good understanding of how the Coveo privilege system works and be well aware of the implications of each choice you make. In this regard, we recommend thoroughly reading the privilege documentation before granting privileges or editing a privilege set, and enforcing the principle of least privilege, that is, granting just enough privileges for the grantee to perform their tasks (see Manage privileges and Principle of Least Privilege).

In the following tables, the typical grantees associated to a privilege are mostly the built-in groups or group templates that are granted this access level by default (see built-in groups comparison tables). However, they could also include typical groups of users that should have the privilege granted to them (for example, support agents). Members of the Administrators group are always granted the highest access level. Similarly, the Typical grantee column shows which API key templates are granted each access level.

Analytics service

Administrate domain

Access level

Grantee abilities

Typical grantees

Allowed

Manage the organization usage analytics data:
- Add and delete test usage analytics data in the account
- Edit, get, delete, and disable the organization account
Define IP addresses whose events are flagged as internal

This privilege is especially potent since grantees can delete usage analytics data and could inadvertently corrupt it as well.

Administrators
Knowledge managers

Analytics data domain

Access level

Grantee abilities

Typical grantees

View

View reports
View dimensions
View named filters
View permission filters
View usage analytics data exports

Analytics managers
Analytics viewers
Relevance managers

Push

Send analytics events to Coveo Usage Analytics (Coveo UA)

OAuth tokens, API keys, and search tokens assigned to a process such as a search interface
Anonymous search API keys
Authenticated search API keys
Usage analytics API keys
Search pages API keys
Anonymous Case Assist API keys

Push and view

Administrators

Data exports domain

The Data exports domain access levels are ineffective without the View access level on the Analytics data domain

Access level

Grantee abilities

Typical grantees

View

View and download usage analytics data exports containing clicks, groups, keywords, searches, and custom events meeting the specified criteria for a specific date range

Edit

Add, edit, or delete analytics data exports from the specified user visits
Review user visits

Administrators
Analytics managers
Analytics viewers
Relevance managers

Data health domain

Access level

Grantee abilities

Typical grantees

View

View organizational data health for a specific date range.

Administrators

Delete user data domain

Access level

Grantee abilities

Typical grantees

Allowed

Delete usage analytics user data

This privilege is especially potent since grantees can delete usage analytics user data. This can break existing reports and also render some datasets inaccurate.

Administrators

Dimensions domain

The Dimensions domain access levels are ineffective without the View access level on the Analytics data domain.

Access level

Grantee abilities

Typical grantees

View

Analytics viewers

Edit

Add, edit, or delete dimensions created by Coveo organization members

Administrators
Analytics managers

Impersonate domain (analytics)

Access level

Grantee abilities

Typical grantees

Allowed

Allow a custom process or bot to push usage analytics events with different identities

Administrators
Usage analytics API keys

Named filters domain

The Named filters domain access levels are ineffective without the View access level on the Analytics data and Dimensions domains.

Access level

Grantee abilities

Typical grantees

View

View named filters

Analytics viewers

Edit

Add, edit, or delete named filters

Administrators
Analytics managers
Relevance managers

Permission filters domain

The Permission filters domain access levels are ineffective without the View access level on the Analytics data and Dimensions domains.

Access level

Grantee abilities

Typical grantees

View

View permission filters restricting the usage analytics data that analysts can review in reports

Note

Without the View access level, you can’t see the permissions filters that are assigned to your identity in reports.

Analytics viewers
Analytics managers
Relevance managers

Edit

Add, edit, or delete permission filters

Note

The Edit access level is ineffective without the View access level on the Groups domain.

Administrators

Property domain

The Property domain access levels are ineffective without the View access level on the Analytics data domain.

Access level

Grantee abilities

Typical grantees

View

View properties that manage tracking IDs across different sites or applications

Analytics viewers
Analytics managers
Relevance managers

Edit

Add a property to register a new tracking ID, or edit or delete an existing property.

Administrators
Analytics managers
Relevance managers

Reports domain

The Reports domain access levels are ineffective without the View access level on the Analytics data and Dimensions domains.

Access level

Grantee abilities

Typical grantees

View

View usage analytics reports (dashboards and explorers)

Analytics viewers

Edit

Add, edit, or delete usage analytics reports (dashboards and explorers)

Note

The Edit access level is ineffective without the Allowed access level on the Administrate domain.

Administrators
Analytics managers
Relevance managers

Snowflake management domain

The Edit access level is ineffective without the Allowed access level on the Administrate domain.

Access level

Grantee abilities

Typical grantees

View

View the Raw Data page
View Snowflake reader account monthly credit consumption

Administrators
Analytics managers
Analytics viewers
Relevance managers

Edit

Add or edit Snowflake reader accounts
Add or block IP addresses
Share Data with other Snowflake accounts

Administrators
Analytics managers
Relevance managers

View all reports domain

Access level

Grantee abilities

Typical grantees

Allowed

View all reports, regardless of report accesses. Members that don’t have this access level can only review the reports they’re explicitly allowed to access.

This privilege is especially potent since grantees bypass report permissions and could therefore access sensitive information that they wouldn’t be allowed to access otherwise.

Administrators
Analytics managers

Commerce service

Catalog domain

Access level

Grantee abilities

Typical grantees

View

View catalog entities and catalog configuration

Edit

Add, edit, or delete catalog entities

Administrators

Merchandising hub domain

Access level

Grantee abilities

Typical grantees

View

View Search, Product listings, and Recommendations managers

Edit

Add, edit, or delete Search, Product listings, and Recommendations managers

Administrators

Content service

Connectivity diagnostic logs domain

Access level

Grantee abilities

Typical grantees

View

Download update logs

Administrators
Content managers

Crawling Module domain

Access level

Grantee abilities

Typical grantees

View

Access the Crawling Modules (platform-ca | platform-eu | platform-au) page
Select the Crawling Module instance responsible for crawling a source

Content managers

Edit

This access level allows a Crawling Module instance to report its status to Coveo. This status is then displayed on the Crawling Modules (platform-ca | platform-eu | platform-au) page. Granting this access level to groups of users doesn’t give them any additional capabilities.

Administrators
Crawling Module API keys

Note

Administrators are granted the highest access level for all domains, including Crawling Module. However, in this case, having the Edit access level instead of View doesn’t grant them any additional capabilities. It only makes a difference for Crawling Module API keys, which require the Edit access level.

Crawling Module log request domain

Access level

Grantee abilities

Typical grantees

View

Granting this privilege to groups of users or API keys doesn’t give them any additional capabilities.

Edit

Download Crawling Module logs from the Activity panel

This privilege is especially potent since grantees can use it to access logs that are normally available to the host server’s administrators only. Although the logs contain no sensitive information such as passwords and no indexed content, they still show the hostname of the Crawling Module host server, the accessed URLs, etc.

Administrators

Extensions domain

Access level

Grantee abilities

Typical grantees

View all

View the code and usage statistics of available extensions assigned to sources. This is especially useful when troubleshooting cases such as item indexing issues.

View

View the code and usage statistics of the specified extensions. This is especially useful when troubleshooting cases such as item indexing issues.

Edit

Add code snippets to apply transformations to indexed items such as adding or modifying metadata. We recommend that you grant this privilege to developers only.

Edit all

Add code snippets to apply transformations to indexed items such as adding or modifying metadata. We recommend that you grant this privilege to developers only.

Administrators
Content managers

Fields domain

Access level

Grantee abilities

Typical grantees

View

View fields and field configuration

Users

Edit

Add, edit, or delete fields
Add, update, or delete fields in batches

Administrators
Content managers

Logical indexes domain

Access level

Grantee abilities

Typical grantees

View

When your organization has more than one index:
- On the Sources page, see in which index the content of each source is stored
- When adding a source, select the index in which the retrieved content will be stored

Edit

This access level doesn’t give its grantee any additional capabilities.

Administrators
Content managers

Push identities to security providers domain

Access level

Grantee abilities

Typical grantees

Custom

Allow

Use the Push API to add, update, or disable security identities in the specified security identity providers

Allow for all providers

Use the Push API to add, update, or disable security identities in any security identity provider

Push items to sources domain

Access level

Grantee abilities

Typical grantees

Custom

Allow

Use the Push API to add, update, or delete items in the specified Push sources
Use the Stream API to add, update, or delete items in the specified Catalog sources
Use the Push API to update the status of the specified Push sources

Allow for all sources

Use the Push API to add, update, or delete items in any Push source
Use the Stream API to add, update, or delete items in any Catalog source
Use the Push API to update the status of a Push source

Security identities domain

The Security identities domain access levels are ineffective without the View access level on the Security identity providers domain.

Access level

Grantee abilities

Typical grantees

View

View security identity provider update status, statistics, and refresh schedule
View security identity provider references such as provider IDs and the sources that use each provider
View the permissions and effective permissions on Coveo organization items
View security identities and their status inside each security provider

Edit

Only required by certain API calls (for example, enable all disabled entities in security cache). Granting this access level to groups of users doesn’t give them any additional capabilities.

Administrators

Security identity providers domain

Access level

Grantee abilities

Typical grantees

View

View security identity provider update status, statistics, and refresh schedule
View security identity provider references such as provider IDs and the sources that use each provider
View security identities and their status inside each security provider

Edit

Administrators

Source metadata domain

Access level

Grantee abilities

Typical grantees

View

View a sample of the metadata discovered while indexing a source

This privilege is especially potent since grantees bypass the content permissions of the sources they can edit. They can therefore access sensitive index content that they can’t normally access in the original repository.

Administrators

Sources domain

Notes

To review source content in the Content Browser, you must have the Allowed access level on the Execute queries domain.
Unlike for other resources, the ability to create sources can be granted without the Edit access level. You can therefore grant a group or API key the View all or Custom access level for the Sources domain and check the Can Create checkbox to allow users to create resources in this domain.

Access level

Grantee abilities

Typical grantees

View all

View all sources
View configuration of all sources
View all source logs
Subscribe to source notifications

Users

View

Edit

Edit or delete specific sources
Schedule source updates
Edit specific source mappings
Launch, pause, resume, and cancel specific source updates
Subscribe to source notifications

Edit all

Add sources
Edit or delete all sources
Edit all source update schedules
Edit all source mappings
Launch, pause, resume, and cancel all source updates
Subscribe to source notifications

Administrators
Content managers

The Edit access level on the Sources domain does not grant the ability to push or stream items to Push and Catalog sources.

Customer service

Case Assist configuration domain

Access level

Grantee abilities

Typical grantees

View

View elements of the Case Assist (platform-ca | platform-eu | platform-au) page

Edit

Manage elements of the Case Assist (platform-ca | platform-eu | platform-au) page

Administrators

Use Case Assist domain

Access level

Grantee abilities

Typical grantees

Allowed

Leverage case assist configurations in support cases

Administrators
Content managers
Relevance managers
Users
Use Case Assist API keys

Insight Panel configuration domain

Access level

Grantee abilities

Typical grantees

View

View elements of the Insight Panel (platform-ca | platform-eu | platform-au) page

Edit

Manage elements of the Insight Panel (platform-ca | platform-eu | platform-au) page

Administrators

Insight Panel interface domain

Access level

Grantee abilities

Typical grantees

View

View an Insight Panel interface in a Customer Relationship Management (CRM) system

Edit

Create, update, or delete an Insight Panel interface

Administrators

Insight Panel items domain

Access level

Grantee abilities

Typical grantees

View

View items relevant to a case using the Insight Panel interface

Administrators
Support agents

Insight Panel User Actions domain

Access level

Grantee abilities

Typical grantees

View

View user actions relevant to a case using the Insight Panel interface

Administrators
Support agents

Knowledge service

Answer manager domain

Both the Edit and View access level on the Answer manager domain allows the member to view all generated answers for which feedback exists in an answer configuration in the Answer Manager. This may include content to which the member may not have access to otherwise through the repository’s permission system.

Exercise caution when granting this privilege to members.

Access level

Grantee abilities

Typical grantees

View

View the feedback for generated answers in the Answer Manager
View the rules in the Knowledge Hub’s Answer Manager

Edit

Add, edit, or delete answer configurations and rules in the Answer Manager
View the feedback for generated answers in the Knowledge Hub’s Answer Manager

Administrators
Knowledge managers

Chunk inspector domain

The Enable access level on the Chunk inspector domain allows the member to view all segments of text (chunks) used during answer generation, as well as the chunks for a given indexed item. This may include content to which the member may not have access to otherwise through the repository’s permission system.

Exercise caution when granting this privilege to members.

Access level

Grantee abilities

Typical grantees

Enable

Access the Knowledge Hub’s Chunk Inspector to view the segments of text (chunks) used for a generated answer or a specific item.

Administrators
Knowledge managers

Knowledge hub domain

Access level

Grantee abilities

Typical grantees

Enable

Access the Coveo Knowledge Hub

Administrators
Knowledge managers

Machine learning service

Allow content preview domain

Access level

Grantee abilities

Typical grantees

Enable

Inspect the resources available to create content-based Coveo Machine Learning models

This privilege gives grantees indirect access to index content. Grantees could therefore have access to sensitive content to which they wouldn’t have under normal conditions.

Administrators
Relevance managers

Models domain

Access level

Grantee abilities

Typical grantees

View

View Coveo Machine Learning models

Edit

Add, edit, or delete machine learning models, and therefore optimize search results relevance and search experience in general

Administrators
Relevance managers

User profiles domain

Access level

Grantee abilities

Typical grantees

View

View the Coveo Machine Learning user profile made for each user or visitor ID

Edit

Edit the Coveo Machine Learning user profile made for each user or visitor ID

Administrators

Organization service

API keys domain

Note

This domain is only available when configuring groups, as API keys can’t be granted the privilege to view or edit other API keys.

Access level

Grantee abilities

Typical grantees

View all

View in read-only mode the configuration of all API keys

Content managers
Relevance managers

View

View in read-only mode the configuration of specific API keys

Edit

Edit, delete, activate, and disable specific API keys

Edit all

Add, edit, delete, activate, and disable all API keys

Administrators

Activities domain

Access level

Grantee abilities

Typical grantees

View

Access the Activity Browser and view all organization activities

A member with the View access level on the Activities domain can access the Activity Browser. This member can therefore see all activities taking place in the organization, including those from Coveo Administration Console pages that they can’t access.

Content managers
Relevance managers

Edit

Send custom activities to Coveo

Administrators

Critical updates domain

Access level

Grantee abilities

Typical grantees

View

Access the list of available critical updates

Edit

Enable/disable critical updates in the organization

Administrators

Customer keys domain

Access level

Grantee abilities

Typical grantees

View

Access the list of available BYOK encryption keys

Edit

Add, activate, or delete BYOK encryption keys

Administrators

Groups domain

Leading practice

Grant the Edit or Edit all access level for the Groups domain only to a few people, ideally the authority in your company that manages access rights in corporate systems.

Access level

Grantee abilities

Typical grantees

View all

View all groups, including their privileges
View organization members

Analytics managers

View

View groups, including their privileges

Content managers
Relevance managers

Edit

Duplicate, edit, or delete groups and members
Edit group member privileges
Send invitations to users

Relevance managers

Edit all

Duplicate, edit, or delete all groups and their members
Edit privileges of all groups
Send invitations to users

Administrators

Note

For the preceding grantees, by default, members of the Relevance Managers built-in group can edit this group only. This allows them to invite other people in the Relevance Managers group, but not in other groups.

The Edit all access level is especially potent since grantees can use it to add anyone, including themselves, to any organization group. This can lead to privilege escalation

Link domain

See Privileges required to manage snapshots for details on the privileges you need to use the resource snapshot feature.

Access level

Grantee abilities

Typical grantees

View

Validate a resource snapshot
View changes to apply

Edit

Match analogous resources

Administrators

Notifications domain

Access level

Grantee abilities

Typical grantees

View

View organization notifications

Edit

Edit and delete organization notifications

Administrators

On-premises administration domain

The privileges of this domain are required by the Coveo Crawling Module API keys only. Granting these privileges to groups of users doesn’t give them any additional capabilities.

Access level

Grantee abilities

Typical grantees

View

Edit

This access level, when granted to a Coveo Crawling Module API key, allows the Crawling Module to communicate with Coveo. Granting it to users or groups doesn’t give them any additional capabilities.

Administrators
Crawling Module API keys

Note

Administrators are granted the highest access level for all domains, including On-Premises Organization. However, in this case, having the Edit access level instead of View doesn’t grant them any additional capabilities. It only makes a difference for Crawling Module API keys, which require the Edit access level.

Organization domain

Access level

Grantee abilities

Typical grantees

View

Access the Coveo Administration Console (if the grantee is a group of users)
View the Coveo license details and limits, as well as the organization basic information

Analytics managers
Analytics viewers
Content managers
Relevance managers
Users

Edit

Administrators

Projects domain

Access level

Grantee abilities

Typical grantees

View

View the organization’s projects

User
Analytics Manager
Analytics Viewer
Relevance Manager
Content Manager
Merchandiser
Knowledge Manager

Edit

Add or edit the organization’s projects

Administrators

Single sign-on identity provider domain

Access level

Grantee abilities

Typical grantees

View

View the organization’s single sign-on configuration

Edit

Configure single sign-on for the organization

Administrators

Snapshots domain

See Privileges required to manage snapshots for details on the privileges you need to use the resource snapshot feature.

Access level

Grantee abilities

Typical grantees

View

View the snapshots in the organization
Copy or download a snapshot
Validate a snapshot
View changes to apply
Match analogous resources

Edit

Create a snapshot
Copy a snapshot to a different organization
Apply a snapshot
Delete a snapshot

Administrators
Analytics managers
Content managers
Relevance managers

Temporary access domain

Access level

Grantee abilities

Typical grantees

View

View who at Coveo has asked for and been granted temporary access to your organization, as well as the privileges they were granted

Edit

Revoke temporary access to your organization

Administrators

Vault entry domain

See Privileges required to manage snapshots for details on the privileges you need to use the resource snapshot feature.

Note

To import sensitive information in your destination organization, you must have both of the following privileges:

The View access level on the Vault entry domain in the origin organization.
The Edit access level on the Vault entry domain in the destination organization.

Access level

Grantee abilities

Typical grantees

View

Import sensitive information (in the origin organization)

Analytics managers
Content managers
Relevance managers

Edit

Apply a snapshot, if it contains sensitive information
Import sensitive information (in the destination organization)

Administrators

Search service

Execute queries domain

Access level

Grantee abilities

Typical grantees

Allowed

For organization members and API keys to send queries and get search results in search pages connected to their Coveo organization

Administrators
Content managers
Relevance managers
Users
Anonymous search API keys
Search pages API keys

Expression validation result domain

Required to use an upcoming feature. Granting privileges on this domain doesn’t give the grantee any additional capabilities yet.

Impersonate domain (search)

Access level

Grantee abilities

Typical grantees

Allowed

Obtain a search token for a search interface that replicates a permission system to execute queries and send usage analytics events as a specific user. See Use search token authentication for more information.

This privilege is especially potent since grantees can impersonate any user and access in search results the content accessible to this user. Grantees could therefore access sensitive items that they can’t normally access in the original repositories.

Administrators
Authenticated search API keys

Modify authentication provider domain

Access level

Grantee abilities

Typical grantees

Allowed

Manage authentication for sources that index permissions, such as when they’re secured with SharePoint claims-based identities

Administrators

Query logs domain

Access level

Grantee abilities

Typical grantees

View

In your consumption dashboard, download a list of the queries performed in a hub during a certain month

Administrators

Query pipelines domain

Access level

Grantee abilities

Typical grantees

View all

View

View query pipeline
View query pipeline rules
View A/B test

Edit

Edit all

Optimize results relevance and search experience in general:

Administrators
Relevance managers

Query pipeline preview domain

Access level

Grantee abilities

Typical grantees

View

Review how changes to result ranking rules affect search results on the Preview test search page.

Administrators
Content managers
Relevance managers
Users

Replay any query domain

Access level

Grantee abilities

Typical grantees

View

Replay a query through the Relevance Inspector.

Administrators
Content managers
Relevance managers
Users

Salesforce index configuration domain

Access level

Grantee abilities

Typical grantees

View

Edit

Link a Coveo organization to a Salesforce organization that uses a Salesforce index

Administrators

Search pages and IPX domain

Access level

Grantee abilities

Typical grantees

View

Access all the hosted search pages and In-Product Experiences (IPX) in the Coveo organization

Users
Search pages API keys

Edit

Add or delete all hosted search pages and In-Product Experiences (IPX)
Customize all hosted search page and In-Product Experience (IPX) interfaces

Administrators

The Edit access level is a sensitive privilege which is typically granted only to administrators. This privilege should remain limited to avoid being exploited by malicious users who could enter unwanted code and put search page users at risk.

Search usage metrics domain

Access level

Grantee abilities

Typical grantees

View

View the Consumption dashboard

Relevance managers

Edit

Edit the entitlement metric of a search hub in the Consumption dashboard

Administrators

View all content domain

Access level

Grantee abilities

Typical grantees

Allowed

Browse all the content of a Coveo organization index

This privilege is especially potent since grantees bypass the content permissions and could therefore access sensitive items that they can’t normally access in the original repositories.

Administrators

Built-in group comparison tables

The following tables compare the privileges granted to each built-in group or group template.

Analytics service

Domain

Administrators

Analytics Managers

Analytics Viewers

Content Managers

Relevance Managers

Users

Knowledge Managers

Allowed

-

-

-

-

-

Allowed

Push and view

View

View

-

View

-

View

Edit

Edit

Edit

-

Edit

-

View

View

View

View

-

View

-

View

Delete user data

Allowed

-

-

-

-

-

-

Edit

Edit

View

-

Edit

-

View

Allowed

-

-

-

-

-

-

Edit

Edit

View

-

Edit

-

-

Permission filters

Edit

View

View

-

View

-

View

Edit

Edit

View

-

Edit

-

Edit

Snowflake management

Edit

Edit

View

-

-

-

Edit

Validate event

View

View

View

-

View

-

-

View all reports

Allowed

Allowed

-

-

Allowed

-

Allowed

Commerce service

Domain

Administrators

Analytics Managers

Analytics Viewers

Content Managers

Relevance Managers

Users

Knowledge Managers

Edit

-

-

-

-

-

-

Merchandising hub

Edit

-

-

-

-

-

-

Product listing

Edit

-

-

-

-

-

-

Content service

Domain

Administrators

Analytics Managers

Analytics Viewers

Content Managers

Relevance Managers

Users

Knowledge Managers

Connectivity diagnostic logs

View

-

-

View

-

-

-

Crawling Module

Edit

-

-

View

-

View

View

Crawling Module log request

Edit

-

-

-

-

-

-

Edit all

-

-

Edit all

-

-

-

Edit

-

-

Edit

View

View

View

Logical indexes

Edit

-

-

Edit

-

-

-

Push identities to security providers

Allow for all providers

-

-

Allow for all providers

-

-

-

Push items to sources

Allow for all sources

-

-

Allow for all sources

-

-

Allow for all sources

Security identities

Edit

-

-

Edit

-

-

-

Security identity providers

Edit

-

-

Edit

-

-

-

Source metadata

View

-

-

-

-

-

-

Edit all

-

-

Edit all

-

View all

View all

"Customer service" service

Domain

Administrators

Analytics Managers

Analytics Viewers

Content Managers

Relevance Managers

Users

Knowledge Managers

Case Assist configuration

Edit

-

-

-

-

-

Edit

Insight Panel user actions

View

-

-

-

-

-

View

Insight Panel configuration

Edit

-

-

-

-

-

Edit

Insight Panel interface

Edit

-

-

-

-

-

Edit

Insight Panel items

View

-

-

-

-

-

View

Use Case Assist

Allowed

-

-

Allowed

Allowed

Allowed

Allowed

"Knowledge" service

Domain

Administrators

Analytics Managers

Analytics Viewers

Content Managers

Relevance Managers

Users

Knowledge Managers

Edit

-

-

-

-

-

Edit

Chunk inspector

Enable

-

-

-

-

-

Enable

Enable

-

-

-

-

-

Enable

Machine learning service

Domain

Administrators

Analytics Managers

Analytics Viewers

Content Managers

Relevance Managers

Users

Knowledge Managers

Allow content preview

Allowed

-

-

-

Allowed

-

Allowed

Edit

-

-

-

Edit

-

View

Edit

-

-

-

-

-

View

Organization service

Domain

Administrators

Analytics Managers

Analytics Viewers

Content Managers

Relevance Managers

Users

Knowledge Managers

Edit all

-

-

View all

View all

-

-

Edit

-

-

View

View

-

-

Critical updates

Edit

View

-

View

View

-

-

Edit all

View all

-

Custom

Custom

-

-

Edit

Edit

-

Edit

Edit

-

-

Edit

-

-

-

-

-

-

On-premises administration

Edit

-

-

-

-

-

-

Edit

View

View

View

View

View

View

Edit

View

View

View

View

View

View

Single sign-on identity provider

Edit

-

-

-

-

-

-

Edit

Edit

-

Edit

Edit

-

-

Temporary access

Edit

-

-

-

-

-

-

Edit

View

-

View

View

-

-

Search service

Domain

Administrators

Analytics Managers

Analytics Viewers

Content Managers

Relevance Managers

Users

Knowledge Managers

Execute queries

Allowed

-

-

Allowed

Allowed

Allowed

Allowed

Expression validation result

View

-

-

-

-

-

-

Allowed

-

-

-

-

-

-

Modify authentication provider

Allowed

-

-

-

-

-

-

View

-

-

-

-

-

-

Query pipeline preview

View

-

-

-

-

-

-

Query pipelines

Edit all

-

-

-

Edit all

-

-

Replay any query

View

-

-

-

-

-

-

Salesforce index configuration

Edit

-

-

-

-

-

-

Search pages and IPX

Edit

-

-

-

-

View

View

Search usage metrics

Edit

-

-

-

View

-

-

View all content

Allowed

-

-

-

-

-

-